CVE-2026-107378

{
  "etk_id": "ETK-2026-996",
  "cve_id": "CVE-2026-107378",
  "display_id": "CVE-2026-107378",
  "ghsa_id": "GHSA-c3jg-qh8m-j3h2",
  "euvd_id": "EUVD-2026-95135",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Quadratic CPU denial of service in CairoSVG SVG rendering",
  "summary": "CairoSVG before 2.9.1 can consume excessive CPU while rendering SVG documents with unusually complex path data. An attacker who can submit an SVG to an application using the affected renderer may cause rendering work to exhaust CPU resources and deny service.",
  "mitigation": "Upgrade CairoSVG to version 2.9.1 or later. Until upgrading, restrict or avoid rendering SVG files from untrusted sources and apply resource limits to rendering workloads.",
  "vendor": "Kozea",
  "product": "CairoSVG",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.9.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "=> 2.9.1"
      ],
      "package_name": "cairosvg",
      "purl": "pkg:pypi/cairosvg"
    }
  ],
  "cwes": [
    407
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0038,
  "epss_percentile": 0.309,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.489083583333333,
  "t0_at": "2026-10-08T17:59:09.505000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-09-07T10:35:52+00:00",
      "days": -31.307841493055555,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T17:59:09.505000+00:00",
      "url": "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2"
    },
    "trigger_signal": {
      "at": "2026-10-08T17:59:09.505000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T17:59:09.505000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107378"
    }
  }
}